CVE-2021-27103criticalunder attackransomwareCWE-918

CVE-2021-27103

Published · Updated

Follow this CVE+ Monitor FTA

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

63Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Actcvss 9.8epss 11%
from disclosure to weapon
Published on NVDFeb 16
CISA KEV+260d
Action required by CISAfederal deadline: 2021-11-17

Apply updates per vendor instructions.

In short

Accellion FTA versions up to 9.12.411 have a flaw where attackers can send specially crafted requests to make the server access internal systems or services it shouldn't. This allows hackers to bypass security boundaries and potentially steal sensitive data.

Technical detail

SSRF vulnerability in Accellion FTA ≤9.12.411 via POST requests to wmProgressstat.html endpoint. Unauthenticated remote attackers can forge server-side requests to internal resources, potentially accessing restricted systems or metadata. Fixed in FTA 9.12.416+.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Accellion FTA 9_12_411 and earlier is affected by SSRF via a crafted POST request to wmProgressstat.html. The fixed version is FTA_9_12_416 and later.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/a